Mains — Privacy Policy
Mains is a workout and food logging app. This policy describes exactly what it collects, what leaves your phone, and who receives it. It is written from the app's source code, not from a template — every statement here corresponds to a code path that exists today.
1. Who is responsible
Mains is published by Yevhenii Skrebtsov, Truskavets'ka 40A, apt. 33, 61067, Kharkiv, Ukraine, the data controller for the processing described here.
Contact for any privacy question or request: support@mains.app
2. The short version
- Mains holds an email address and password for your account. That is the only account data.
- Everything you log stays on your phone. Cloud sync is not switched on in the shipped app, so there is currently no server copy of a single workout, meal, weigh-in or body measurement.
- The AI features send what you point them at — a photo, a PDF, or text you typed — to our server, which forwards it to Anthropic to be read. Nothing else about you goes with it.
- Apple Health is read-only. Mains never writes to Health, never sells Health data and never uses it for advertising.
- There is no analytics, no crash reporting, no advertising, no tracking, and no sale of data.
- You must be 16 or older to use Mains.
3. What stays on your phone (which is nearly everything)
Mains is offline-first. Your log lives in a SQLite database on the device and the app reads it directly; there is no round trip to a server to show you your own data.
Stored only on your device today:
| Category | Examples |
|---|---|
| Profile | date of birth, sex, height, locale, time zone, units, meal names, dietary preferences |
| Goals | calorie and macro targets, named goal profiles, per-day assignments |
| Workouts | routines, folders, exercises, performed workouts, every set (weight, reps, timestamps) |
| Food | custom foods, diary entries with their macro snapshots, saved meals, water logs |
| Body | weigh-ins and body measurements |
| Apple Health | the daily steps / sleep / energy / exercise-minutes / heart-rate rows imported from Health |
None of it is uploaded. The sync subsystem is built but is not configured in the shipped app, so the upload path has never run.
There is no backup. Your log exists in one file on one phone. If you lose the phone, reinstall the app, or sign out, that data is gone and we cannot recover it — we never had a copy. Use You → Export my data regularly if your history matters to you.
4. What leaves your phone, and to whom
There are exactly seven outbound channels in the app. This section lists all of them.
4.1 Your account — Supabase
Signing up sends your email address and password to Supabase, which hosts our authentication service and database. Supabase stores the email address and a hash of the password; we never see or store the password itself. Your session token is kept in the iOS Keychain on your device.
Region: eu-central-1 (AWS Frankfurt, Germany — within the EU/EEA).
Because sync is off (§3), Supabase holds no rows of your logged data — only the account record itself.
4.2 The AI features — our server, then Anthropic
Mains has eight AI capabilities. Each one is a single request carrying only the thing you gave it, plus your login token so we know the request is from a real account.
| Feature | What you do | What is sent |
|---|---|---|
label_parse | Photograph a nutrition label | the photo |
food_photo | Photograph a meal | the photo |
menu_parse | Photograph a restaurant menu | the photo |
plan_parse | Photograph a training plan, or pick a PDF from Files | the image or the PDF you chose |
weight_parse | Import a weight history | a screenshot, or pasted text, or a CSV's header + up to 30 sample rows |
nl_food | Describe a meal in words | your text |
food_describe | Describe a food to build a nutrition panel | your text |
ping | (connectivity check) | nothing about you |
Three details that are easy to miss and that you are entitled to know:
- “Recheck” sends a free-text note. When a reading looks wrong you can tap Recheck and type what you think is wrong (“the calories are the kJ figure”). That sentence, together with the previous reading, is sent with the second request.
- Unrecognised CSV exports send sample rows. If you import a weight file whose format we do not recognise, we send its header line and up to 30 example rows so the AI can tell us which column is the date and which is the weight. We then apply that mapping to the rest of the file on your phone — the file itself is never uploaded.
- Training-plan import accepts a PDF you pick from Files. Whatever is in that PDF — including anything a coach wrote on it that is not about training — is sent.
What is NOT sent with an AI request. The request carries your locale, your time zone and the app version, and nothing else about you. Your name, email, account id, date of birth, sex, height, weight, goals and diary are never included in a prompt.
What our server keeps. Nothing. The image or text is held in memory for the length of the request and is not written to any database or file store. Our server log records one line per request containing a request id, a truncated 8-character account id, timings, token counts and a status code — never the content of your request.
Anthropic processes the request as our sub-processor and returns the reading. See §6.
4.3 Food search — our server
When you type in the food search box, the search text is sent to our database with your login token, and matching foods come back.
4.4 Barcode lookup — our server
Scanning a barcode sends the scanned number (GTIN) with your login token.
4.5 Open Food Facts — contacted directly by your phone
When our own food catalog does not have what you scanned or searched for, your phone contacts
Open Food Facts directly to ask. The request carries the barcode or the search
words, your device's IP address (unavoidable for any internet request) and the identifier
Mains/1.0 (mains.app). It does not carry your login token, your email,
or your account id — Open Food Facts cannot connect the query to you as a Mains user.
This is a direct connection between your device and Open Food Facts. We do not control or receive their server logs. It only fires for a search of 3+ characters when our own results came up thin, and for barcodes our catalog missed.
4.6 App updates — Expo
Mains ships JavaScript updates over the air. At every cold start the app asks Expo's update
server (u.expo.dev) whether a newer version exists. That request carries an install
identifier, the app and runtime version, and your IP address. It carries nothing about your account
or your data, and the install identifier is never joined to your account.
4.7 Apple Health — read-only, and it does not leave the phone
If you connect Apple Health, Mains reads exactly eight kinds of data: body mass, step count, sleep analysis, active energy burned, basal energy burned, Apple exercise time, resting heart rate, and heart-rate variability (SDNN).
- Mains never writes anything to Apple Health. Write permission is not requested at all.
- Health data read by Mains is stored on your device with the rest of your log, and — because sync is off (§3) — it is not uploaded anywhere.
- Mains never sells Health data and never uses it for advertising. This is a HealthKit Developer Program obligation and we state it verbatim.
- Health data is never sent to the AI features. The AI features only ever receive the photo, file or text you hand them (§4.2).
You can revoke Health access at any time in iOS Settings → Privacy & Security → Health → Mains.
4.8 Account deletion — our server
Tapping Delete account sends only your (freshly re-authenticated) login token. No other data is attached to the request.
4.9 Cloud sync — currently off
The app contains a full sync subsystem that would upload your log to Supabase. It is not enabled in any shipped build, so it has never run. If we ever turn it on, this policy will be updated before the change ships, and the App Store privacy labels will be updated with it.
5. What we do NOT do
Each of these is verifiable by inspecting the app, not merely promised:
- No analytics. No PostHog, no Firebase, no Amplitude, no home-grown event pipeline. The analytics configuration slots exist and are empty in every shipped build.
- No crash reporting. Sentry is not installed; crashes are visible only in the on-device developer log.
- No advertising and no ad SDKs.
- No tracking, in Apple's sense. Your data is never linked with data from other companies' apps or websites for advertising or measurement. Mains shows no App Tracking Transparency prompt because it has nothing to ask for.
- No sale of data, and no sharing for cross-context behavioural advertising (CCPA/CPRA terms).
- No purchases, subscriptions or paywalls in this version; no payment SDK is present.
- No push notifications from us. Rest-timer and reminder notifications are scheduled locally on your device; no push token is ever created or sent.
- No microphone, no location, no contacts, no calendar access. The microphone permission string is deliberately deleted from the binary because the app has no audio feature.
6. Who else processes your data (sub-processors)
| Processor | What they receive | Why |
|---|---|---|
| Supabase | your email address, password hash, session tokens; your login token on food-search, barcode, AI and delete requests | authentication, the food catalog, and hosting the AI proxy |
| Anthropic | the photo, PDF, or text you handed to an AI feature, plus your locale/time zone/app version | reading labels, meals, menus, plans and weight histories |
| Open Food Facts | a barcode or search words, and your device's IP address | looking up packaged foods our catalog lacks |
| Expo (EAS Update) | an install identifier, app/runtime version, IP address | delivering app updates |
| Apple | App Store account and device-level data governed by Apple's own policy | distributing the app; HealthKit lives entirely on your device |
Which AI models. Requests are answered by Anthropic's claude-haiku-4-5
and, for higher-resolution reading and second-look rechecks, claude-sonnet-5.
Anthropic processes these requests under their commercial API terms and their published data retention policy. We have no separate arrangement that would allow your content to be used to train models.
7. AI outputs are estimates you confirm
- The AI never writes to your diary. Every AI result lands on a review screen where you can edit every number before anything is saved. Nothing is logged until you confirm it.
- AI-generated numbers are marked as such. Features that transcribe what is printed (nutrition labels, menus, training plans, weight screenshots) are not marked, because they copy what you can already see. Features that estimate — a meal photo, a typed meal description, a described food — carry a non-dismissible “estimated by AI” notice on screen and an AI marking stored with the entry, as required by Article 50 of the EU AI Act.
Mains is not a medical device and gives no medical advice. Calorie and macro figures — whether from a database, a label or an AI estimate — are approximations. Do not use them to manage a medical condition without professional advice.
8. How long we keep things
| Data | Retention |
|---|---|
| Your log (workouts, food, weight, health) | On your device, for as long as you keep the app installed. Deleting the app deletes it. |
| Account record (email, password hash) | Until you delete your account (§9), then removed immediately. |
| AI request content | Not retained by us. Held in memory for the request only; never written to a database or file store. |
| Server request logs | Short-lived operational logs with no request bodies: request id, truncated account id, timings, token counts, status. |
| Anthropic | Per Anthropic's own retention policy for API requests. |
| Open Food Facts / Expo | Per their own policies; we receive nothing back from them about you. |
9. Your rights, and how to use them in the app
Under the GDPR (and comparable laws elsewhere) you have the right to access, correct, export and erase your data, and to object to or restrict processing. Two of these are one tap away:
Export your data (portability)
You → Export my data. Mains assembles every row it holds for you — profile, goals, workouts, routines, foods, diary, saved meals, water, body metrics and imported Health rows — into a single JSON file and hands it to the iOS share sheet, so you can save it to Files, email it, or send it anywhere you like. Nothing is uploaded to produce it.
Delete your account and everything in it (erasure)
You → Delete account. You re-enter your password, type DELETE to confirm, and are offered an export first. On confirmation Mains deletes every server-side row belonging to you, deletes your authentication account, and wipes the local database on the device.
The deletion is immediate and irreversible. We keep no copy and cannot restore it.
Everything else
For access, correction, restriction, objection, or a complaint, write to support@mains.app. We answer within 30 days. You also have the right to complain to your national data protection authority.
10. Age
Mains is for people aged 16 and over. The app asks for your date of birth during setup and will not let you continue if you are under 16. We do not knowingly collect data from anyone younger; if you believe a younger person has an account, write to support@mains.app and we will delete it.
11. International transfers
Mains's sub-processors (§6) may process data outside your country, including in the United States. Where that happens we rely on the transfer mechanisms in those processors' own terms — for Anthropic and Supabase, their standard data processing agreements and Standard Contractual Clauses.
12. Security
- Passwords are never stored by us in readable form; authentication is handled by Supabase.
- Your session token is stored in the iOS Keychain, not in ordinary app storage.
- All network traffic uses HTTPS.
- Database access is scoped per account by row-level security on the server.
- The account-deletion endpoint refuses a stale session: you must have signed in within the last few minutes for it to run.
No system is perfectly secure, and the honest caveat that matters most for this app is the one in §3: because your log is device-local, its security is your device's security.
13. Data sources and attribution
Mains's food catalog is built from public data:
- USDA FoodData Central — U.S. Department of Agriculture, Agricultural Research Service. Public domain.
- Open Food Facts — community database, made available under the Open Database License (ODbL).
Full attribution and licence terms are on the attributions page that ships beside this one
(attributions.html).
14. Changes to this policy
If we change what the app collects or who receives it, we will update this page and change the “Last updated” date. A change that materially expands processing — turning on cloud sync being the obvious one — will be announced in the app before it takes effect.